Re: [Suit] COSE_Sign vs. COSE_Mac

I would assume that the key management can be localized to the installation
That is the file can be signed from the manufacturer to the company and then
the PSK work can be done inside of the company.  Strip the COSE_Sign and
switch to COSE_Mac.  Given that one could have run a one time protocol to
derive the update PSK, I don't see that this is going to give a significant
loss of security.  The main issue is that one would need to scope the use of
PSKs to a small area with the SUIT manager doing the PSK computation

Jim

> -----Original Message-----
> From: Suit <suit-bounces@ietf.org> On Behalf Of Brendan Moran
> Sent: Monday, June 4, 2018 11:24 AM
> To: Russ Housley <housley@vigilsec.com>
> Cc: suit@ietf.org
> Subject: Re: [Suit] COSE_Sign vs. COSE_Mac
> 
> This is a solution that is intended to address a segment of devices that
cannot
> use public-key due to code size or processing overhead, and cannot use
> hash-based signatures due to data overhead. Provided that every device has
> a unique PSK, COSE_Mac provides adequate security. However, it introduces
> significant key management overhead.
> 
> Thanks,
> Brendan
> 
> > On 4 Jun 2018, at 16:16, Russ Housley <housley@vigilsec.com> wrote:
> >
> > I am struggling to see a case where COSE_Mac provides acceptable
> protection.  With a MAC, the sender and the recipient must use the same
> key.  This means that any recipient can make a modification and produce a
> valid MAC for the modified object.
> >
> > With a digital signature, the sender uses a private key, and the
recipients
> use a public key, so the recipients cannot produce modified objects.
> >
> > Why accept this possibility?
> >
> > Russ
> >
> > _______________________________________________
> > Suit mailing list
> > Suit@ietf.org
> > https://www.ietf.org/mailman/listinfo/suit
> 
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
recipient,
> please notify the sender immediately and do not disclose the contents to
any
> other person, use it for any purpose, or store or copy the information in
any
> medium. Thank you.
> 
> _______________________________________________
> Suit mailing list
> Suit@ietf.org
> https://www.ietf.org/mailman/listinfo/suit